1. 1 Putting 2 & 2 Together By Stephen Dugan, CCSI scdugan@101labs.com

2. 2 Introduction Welcome to the presentation and Thank you for coming!  Who is the speaker?  What is the focus of the presentation?

3. 3 Agenda  Introduction  Section 1 – Current Design Best Practices  Section 2 – Emerging Design Practices  Extras?

4. 4 Section 1 Current Design Model

5. 5 Building Block of Network Design Distribution Access CORE WANWANInternetInternetPSTNPSTN Server Farm Building Block Additions Ethernet Layer 2 or Layer 3

6. 6 Section 1 – Current Design Model Features: Link redundancy Load-Sharing Fast Convergence Manageable Scalable Security could be stronger….

7. 7 Section 1 – Current Design Model L2 Functions that provide security: Root Guard PortFast BPDU Guard Port Security Management VLAN Private VLANs

8. 8 Section 1 – Current Design Model L3 Functions that provide security: ACLs at Distribution Layer: Ingress - Egress from Core Route Filtering Network Based IDS (if used?!?)

9. 9 Section 1 – Current Design Model Hard issues to Address with this design: HSRP insecurities STP weaknesses ARP Spoofing Common mis-configurations

10. 10 Section 2 Emerging Changes to Design Model

11. 11 Section 2 – Emerging Changes Main Changes is focusing around bringing the Layer 3 Routing functionality close to the end stations. OR R2D Routing to Desktop

12. 12 Section 2 – Emerging Changes Access Layer 3 Distribution Layer 3 Core L2 or L3 From the Physical Layout it looks the same (Good news no Rewire!)

13. 13 Section 2 – Emerging Changes With L3 Capabilities within the Access-Layer Box: HSRP isn’t needed STP is irrelevant Routing to Distribution Layer Concept of “Private-VLANs” can be implemented easily L3

14. 14 Section 2 – Emerging Changes Security Problems Solved: ARP Spoofing ROOT Take over HSRP MiTM Attack (or DOS) Better QOS handling (NBAR) L3

15. 15 Section 2 – Emerging Changes Access Layer GigE Dist. OSPF or EIGRP VLAN 2 VLAN 3 VLAN 4 VLAN 5 VLAN 6

16. 16 Links  General Cisco Security http://www.cisco.com/warp/public/707/21.ht ml#http http://www.cisco.com/warp/public/707/21.ht ml#http http://www.cisco.com/public/cons/isp/docum ents/IOSEssentialsPDF.zip http://www.cisco.com/public/cons/isp/docum ents/IOSEssentialsPDF.zip http://www.cisco.com/warp/public/cc/so/cuso /epso/sqfr/safe_wp.htm  Design http://www.cisco.com/warp/public/cc/so/neso /lnso/cpso/gcnd_wp.htm http://www.cisco.com/warp/public/cc/so/neso /lnso/cpso/gcnd_wp.htm

17. 17 Thank you for coming!! Special thanks to Jeff Moss, Keith Myers and the rest of the Black Hat Crew.